SSL and Custom Domains Guide: How to Fix "Not Secure" Warnings or 404 Errors

When you connect your own domain to the Hostaway Booking Engine or the Website Pro version, our system automatically generates and installs a free SSL security certificate via Let's Encrypt. There is no need for you to purchase or install an SSL on your own.

Important Security Note: Hostaway no longer supports third-party SSL certificates. The certificate must be automatically issued by our proxy servers to ensure correct processing of payments and bookings.

This process is automated, but it requires an exact DNS configuration. Any error in your DNS records will prevent the certificate from being issued.

Step 1: Identify your site type and structure in Hostaway

DNS instructions and dashboard settings vary depending on the Hostaway tool you are using:

Option A: Basic Booking Engine

Go to Booking Website > Settings > Domain & Security:

1. If using your Main Domain (e.g., mysite.com):

• Select Use Main Domain and enter your domain (without "www").
• In your DNS provider, add these records:

2. If using a Subdomain (e.g., book.mysite.com):

• Common Error! Do not enter book.mysite.com in "Use Main Domain".
• You must select the Use Subdomain option. Enter book in the Subdomain name field and mysite.com in the Domain name field.
• In your DNS provider, only add this record for the subdomain:

Note for subdomains: Ensure there are no additional A, AAAA, or ALIAS records specific to the book subdomain.

Mandatory Requirement for Booking Engine: You must configure Google reCAPTCHA v2 ("I'm not a robot") keys under the same section for the domain to save and function correctly.

Option B: Website Builder Pro (Duda)

If you designed a custom Pro website, the configuration is different:

Step 2: Configuration by DNS Provider

1. GoDaddy

1. Log in to GoDaddy and access your DNS Management panel.
2. Edit or create the CNAME record (www or your subdomain like book) to point to the corresponding Hostaway destination.
3. Edit or create the A record (@) to point to the Hostaway IP.
4. Important! Make sure to delete any old A records or duplicate IPv6 (AAAA) records, as they will block certificate validation.

2. Cloudflare

If you manage your records through Cloudflare:

1. Go to the DNS > Records tab.
2. Create the A and CNAME records as appropriate.
3. Critical Step (Orange Cloud vs. Gray Cloud): For both records, you must change the Proxy Status from Proxied (orange cloud) to DNS Only (gray cloud). If the Cloudflare proxy is active, Let's Encrypt will be unable to validate your domain, resulting in errors like Error 525 (SSL Handshake Failed) permanently.

Step 3: Wait times and the "8-hour Rule"

• DNS Propagation: Changes can take between 2 and 24 hours to apply globally.
• Certificate Issuance: Hostaway automatically processes and generates certificates in two daily time windows: from 1:00 AM to 4:00 AM CET and from 1:00 PM to 4:00 PM CET.
• The 8-hour Rule (Very Important!): After adding and saving the domain in your Hostaway dashboard, the corresponding DNS changes must be completed immediately. If the DNS is not correctly configured or does not propagate within the first 8 hours, the Let's Encrypt queue will fail, and the system will stop trying to generate the SSL automatically. (See the Troubleshooting section below to fix this).
• Expected behavior in the first 24-48 hours: It is completely normal to see the Chrome error NET::ERR_CERT_COMMON_NAME_INVALID or for the website to show a security certificate assigned to a generic Hostaway domain (such as auravacationhomes.com). Do not make further changes to the DNS during this period, as you would restart the wait time.

Troubleshooting Checklist

If more than 48 hours have passed and your site still shows "Not Secure" or a 404 error:

1. Rule out a browser cache issue first: Open your site in an incognito or private browsing window. If it loads securely there, your browser is simply showing a cached version of the old (unsecured) state — clear your browser cache and cookies, then reload in your normal window. No DNS changes are needed.
2. Verify actual propagation with WhatsMyDNS:
   • Go to whatsmydns.net.
   • Look up your A record (for the root domain) and your CNAME record (for the subdomain or www).
   • Confirm they match only the IP addresses and destinations assigned by Hostaway. If old IPs from your previous server appear, delete them immediately.
3. Remove incompatible records:
   • Verify that there are no active AAAA (IPv6) records or CAA records in your DNS zone. These records physically block the issuance of Let's Encrypt certificates.
4. How to "unstick" the SSL queue (Force regeneration): If the DNS configuration was completed late (after the 8-hour grace period), you must restart the proxy queue as follows:
   • Go to Booking Website > Settings > Domain & Security.
   • Temporarily uncheck the "Use your own domain" box (switching back to the default Hostaway domain) and click Save.
   • Wait 5 to 10 minutes for the proxy to process the change.
   • Re-enable "Use your own domain", enter your custom domain correctly, and click Save.
   • Click the black Republish button in the top-right corner of your website dashboard. This will send a clean new request to the Let's Encrypt queue.